AccessRule Not Working

[Teresa Fasano]

Hi,
I need to set an access rule on my SP service to disable access to users 
having the profile as a student.

The rule should only be applied to a specific path:
<Host name="myurl" authType="shibboleth" requireSession="true" 
applicationId="default">
<Path name="/path-notstudent" authType="shibboleth" 
requireSession="true" applicationId="default">
       <AccessControl>
           <NOT>
               <Rule require="Shib-Attr-Profilo">STUDENTE</Rule>
           </NOT>
       </AccessControl>
    </Path>

</Host>


In transaction.log I see "Shib-Attr-Profile" attribute with its value:

2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: Cached the 
following attributes with session (ID: 
_eb39f1b97391bd568afecb3a6f8a302a) for (applicationId: default) {
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: Shib-Attr-Uid (1 
values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: 
Shib-Attr-Matricola (1 values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: Shib-Attr-Cognome 
(1 values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: 
Shib-Attr-Scoped-Affiliation (2 values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: 
Shib-Attr-Str-App-DN (1 values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: Shib-Attr-Mail (1 
values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: Shib-Attr-Profilo 
(1 values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: Shib-Attr-Nome (1 
values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: Shib-Attr-CDS-DN 
(1 values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: 
Shib-Attr-CodStruttAppart (1 values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: 
Shib-Attr-Common-Name (1 values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: 
Shib-Attr-Targeted-ID (1 values)
2016-08-05 13:41:53 INFO Shibboleth-TRANSACTION [118]: 
Shib-Attr-Codice-Fiscale (1 values)

Using a simple script to print the output of variables I see:
[Shib-Attr-Profilo] => STUDENTE

In the config file of Apache I have:

<Location /path-notstudent>
         AuthType shibboleth
         ShibRequestSetting applicationId default
         ShibRequestSetting requireSession 1
         ShibRequireSession On
         Require valid-user
</Location>

Seems rights but the rule has no effect: students enter in the application.
Any idea?

Thanks,
Teresa


-- 
----------------------------------
L'educazione è il pane dell'anima
----------------------------------

Teresa Fasano

CINECA
System and Technologies Department
Middleware and Infrastructure Group
Via Magnanelli, 6/3
Casalecchio di Reno (Bologna) ITALY

web:     http://www.cineca.it
e-mail:  t.fasano at cineca.it
phone:   +39 051 61 71 364